CVE-2026-9082

Name of the Vulnerable Software and Affected Versions Drupal Core versions 8.9.0 through 10.4.9 Drupal Core versions 10.5.0 through 10.5.9 Drupal Core versions 10.6.0 through 10.6.8 Drupal Core versions 11.0.0 through 11.1.9 Drupal Core versions 11.2.0 through 11.2.11 Drupal Core versions 11.3.0 through 11.3.9

Description An unauthenticated SQL injection flaw exists in the database abstraction API of Drupal Core, specifically within the PostgreSQL EntityQuery condition handler. The issue occurs when attacker-controlled PHP array keys, such as filter[...][condition][value][malicious key], are concatenated directly into SQL identifiers without proper sanitization. This vulnerability exclusively affects sites using PostgreSQL databases. Remote anonymous users can exploit this to achieve full database access, exfiltrate sensitive data, and escalate privileges to Administrator. In environments where database permissions are misconfigured (e.g., allowing COPY FROM PROGRAM), it can lead to remote code execution. Real-world exploitation is active, with over 15,000 attack probes detected across approximately 6,000 sites in 65 countries, heavily targeting gaming and financial services.

Recommendations Update Drupal Core to version 10.4.10. Update Drupal Core to version 10.5.10. Update Drupal Core to version 10.6.9. Update Drupal Core to version 11.1.10. Update Drupal Core to version 11.2.12. Update Drupal Core to version 11.3.10. Restrict user roles that have the ability to update Twig templates via Views or contributed modules. Route production traffic through a Web Application Firewall (WAF) to filter malicious nested array payload signatures. Review PostgreSQL and WAF logs for unusual anonymous user queries or structural query modifications.